CVE-2026-58882

No known exploitation. No EPSS score yet. No fix published yet.

CVSS —Not scored EPSS percentile—No score yet CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-11-02Updated 2026-11-03Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Google AndroidAffected: 17Upgrade to: not statedAffected: 16-qpr2Upgrade to: not statedAffected: 16Upgrade to: not statedAffected: 15Upgrade to: not stated + 1 more branchStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Identify which company phones run Android and check with your device vendor or carrier whether this issue (CVE-2026-58882) has been acknowledged.
Watch for an Android security update from your phone manufacturer (Google, Samsung, etc.) that names this CVE — no fixed version is available yet.
Keep automatic system updates turned on for all company Android devices so any future patch installs promptly.
If a device starts behaving oddly after receiving unexpected text messages, reboot it and report the issue to your IT support.

May need vendor or contractor work

What it is

From the CVE record

In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In plain language

Written by AI from the record

This is a bug in Android's messaging code that could let someone crash a phone remotely by sending a malformed text message, but there's no sign it's being used by attackers and no fix available yet, so most small businesses don't need to act urgently.

An integer overflow in WapPushOverSms.java's decodeWapPdu function causes an out-of-bounds read when parsing crafted WAP push SMS messages, allowing an unauthenticated remote denial of service against the Android messaging stack with no user interaction required.

If you're affected

Device crash / reboot
Temporary loss of phone use
Operational disruption on affected devices

What is it

Think of this like a prank phone call that's specially designed to make your phone's voicemail system glitch and hang up — except here it's a text message crafted to confuse the part of Android that reads text messages, causing the phone to crash or restart. It doesn't steal data or give an attacker control of the device; it just disrupts it temporarily.

Who is affected

This matters to you if your business uses Android phones or tablets for calls, texts, or daily operations. It affects the underlying Android messaging component, not a specific app, so the exposure applies broadly across Android devices regardless of carrier.

How urgent is it

There is no evidence this is being exploited by attackers, it isn't on any government list of actively-exploited threats, and no working exploit code has been published. Given that, this is a low-urgency issue for a typical small business — worth tracking, not worth disrupting your day for.

What to do — in detail

To assess exposure, inventory Android devices used in the business and check their current security patch level (Settings > About Phone > Android security patch). Since no fixed version or vendor advisory is currently available for CVE-2026-58882, there is no upgrade path to recommend yet. As a temporary mitigation, there is no app-level workaround since the flaw sits in system-level SMS/WAP push handling (WapPushOverSms.java); carriers/OEMs may filter malformed WAP push PDUs at the network level, but this is outside end-user control. Monitor Android Security Bulletins (AOSP/Google monthly bulletins, and OEM-specific ones) for a patch referencing this CVE, and apply it via standard OTA update processes once released. No CISA KEV listing exists, so there is no mandated remediation deadline. Track for any shift from predicted to confirmed exploitation via future KEV or news updates.

Technical context

Weakness: integer overflow leading to out-of-bounds read (CWE-190 / CWE-125-adjacent), in the decodeWapPdu function of WapPushOverSms.java within the Android telephony/messaging stack. Attack vector: remote, network-based (crafted WAP push SMS), no authentication or user interaction required — impact limited to denial of service (crash/restart), not code execution or data compromise. Exploitation status: not listed in CISA KEV, no public exploit code identified, press attention is newly emerging but does not indicate active exploitation. No patch/fixed version currently published. EPSS data not provided in findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

CISA KEV: Not in the catalog. CISA has not confirmed exploitation.
Public exploits: No public exploit or proof of concept found in the sources we track.
EPSS: No EPSS score yet. New CVEs are usually scored within a few days.